Cloud Build Secure Ci Iam Secret Manager Configuration

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise is designing a secure Continuous Integration (CI) pipeline using Cloud Build triggered from a Secure Source Manager repository. The pipeline must fetch application dependencies, retrieve sensitive API keys from Secret Manager, build container images, push them to Artifact Registry, and create attestations for Binary Authorization. To enforce security compliance, your team must adhere strictly to the principle of least privilege for all service identities involved in build invocation and execution.

Which IAM role and identity configuration should you implement?

Configure a user-managed service account for the repository with the Cloud Build Editor role and Service Account User role on a dedicated Cloud Build execution service account, and grant the Cloud Build execution service account the Secret Manager Secret Accessor role on the required secret along with the Artifact Registry Writer role.

Generate a downloadable JSON service account key for a shared deployment service account, store the key file in the Git repository root, and grant the service account the Artifact Registry Administrator role.

Assign the default Cloud Build Service Account the Project Editor role and grant the Secure Source Manager Service Agent the Secret Manager Admin role across the project.

Grant the Container Analysis Notes Editor role to the Cloud Build execution service account in the customer project and assign the Artifact Registry Reader role on the destination repository.

Professional Cloud DevOps Engineer

Cloud Build Secure Ci Iam Secret Manager Configuration

Related questions